CVE-2025-1128: Everest Forms RCE Vulnerability

CVE-2025-1128 Overview

CVE-2025-1128 is a critical arbitrary file upload, read, and deletion vulnerability affecting the Everest Forms WordPress plugin. The vulnerability exists due to missing file type and path validation in the format method of the EVF_Form_Fields_Upload class in all versions up to and including 3.0.9.4. This flaw allows unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server, potentially leading to remote code execution, sensitive information disclosure, or complete site takeover.

Critical Impact

Unauthenticated attackers can achieve remote code execution by uploading malicious files, access sensitive configuration files, or cause complete site destruction through arbitrary file deletion—all without any authentication requirements.

Affected Products

• Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress versions ≤ 3.0.9.4
• wpeverest everest_forms (all versions through 3.0.9.4)
• WordPress installations with vulnerable Everest Forms plugin installed

Discovery Timeline

• 2025-02-25 - CVE-2025-1128 published to NVD
• 2025-02-28 - Last updated in NVD database

Technical Details for CVE-2025-1128

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue lies in the insufficient validation within the file upload handling mechanism of the Everest Forms plugin. The format method in the EVF_Form_Fields_Upload class fails to properly validate both file types and file paths before processing uploads.

The vulnerability is particularly dangerous because it requires no authentication. Any unauthenticated user interacting with forms built using the Everest Forms plugin can exploit this flaw. The attack surface is network-accessible, requires low complexity to exploit, and requires no user interaction—making it highly exploitable in real-world scenarios.

Root Cause

The root cause is the absence of proper file type and path validation in the EVF_Form_Fields_Upload class. When a user uploads a file through a form, the plugin's format method processes the upload without adequately verifying:

1. Whether the uploaded file type matches allowed file extensions
2. Whether the file path is constrained to safe directories
3. Whether the MIME type corresponds to the actual file content

This allows attackers to bypass intended restrictions by manipulating file extensions or paths, enabling the upload of executable PHP files or the reading/deletion of sensitive server files.

Attack Vector

The vulnerability can be exploited through HTTP requests to WordPress sites with the vulnerable plugin installed. Attackers can craft malicious form submissions that:

1. Upload arbitrary files: Upload PHP web shells or malicious scripts that can be executed on the server
2. Read sensitive files: Access configuration files like wp-config.php containing database credentials
3. Delete critical files: Remove essential WordPress files, causing site destruction or denial of service

The attack requires only network access to the target WordPress site with no authentication needed, making mass exploitation feasible.

 			if ( $proper_filename || ! $ext || ! $type ) {
 				evf()->task->errors[ $form_data['id'] ][ $field_id ] = esc_html__( 'File type is not allowed.', 'everest-forms' );
 				update_option( 'evf_validation_error', 'yes' );
+				wp_die( 'File type is not allowed' );
 			}
 
 			// Allow third-party integrations.

Source: GitHub Commit Change

The patch adds a critical wp_die() call that terminates script execution when an invalid file type is detected. Previously, the code would set an error message but continue processing, allowing the malicious upload to proceed.

Detection Methods for CVE-2025-1128

Indicators of Compromise

• Unexpected PHP files appearing in the WordPress uploads directory or plugin folders
• Web server logs showing POST requests to Everest Forms endpoints with suspicious file uploads
• Presence of web shells or backdoor files in publicly accessible directories
• Evidence of wp-config.php or other sensitive file access in server logs
• Unexplained file deletions or modifications to core WordPress files

Detection Strategies

• Monitor WordPress upload directories for newly created PHP or executable files
• Implement Web Application Firewall (WAF) rules to detect malicious file upload attempts
• Review web server access logs for unusual POST requests containing file upload parameters targeting Everest Forms
• Deploy file integrity monitoring to detect unauthorized changes to WordPress core and plugin files

Monitoring Recommendations

• Enable real-time file system monitoring on WordPress installation directories
• Configure alerts for any PHP file creation in upload directories
• Monitor for suspicious form submission patterns or high-volume automated requests
• Implement logging of all file operations performed by WordPress plugins

How to Mitigate CVE-2025-1128

Immediate Actions Required

• Update Everest Forms plugin to version 3.0.9.5 or later immediately
• Audit WordPress uploads directory for any suspicious or unexpected PHP files
• Review web server logs for evidence of exploitation attempts
• If compromise is suspected, perform a full site backup and forensic analysis before remediation

Patch Information

WPEverest has released security patches addressing this vulnerability. The fix is available in the official GitHub repository and through the WordPress Plugin Directory. The patch adds proper termination of script execution when invalid file types are detected, preventing the bypass of file type validation.

For detailed technical information about the vulnerability, refer to the Wordfence Vulnerability Report.

Workarounds

• If immediate patching is not possible, temporarily disable the Everest Forms plugin until update can be applied
• Implement server-level restrictions to prevent PHP execution in upload directories using .htaccess rules
• Deploy a Web Application Firewall with rules to block malicious file upload attempts
• Restrict file upload functionality at the form level until the plugin is updated

# Apache .htaccess rule to prevent PHP execution in uploads directory
# Add to /wp-content/uploads/.htaccess
<FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Alternative: Disable PHP execution entirely in uploads
php_flag engine off